Shell Programming and Scripting

Hi,

As a security measure, we need to force all the users to use MD5 encryped passwords. For that we need to list users whose encrypted password is not MD5. I understand all MD5 encrypted passwords start with $1$ and a sample entry in /etc/shadow would be

Code:

user03:$1$ZiusVx0w$z2qflR9tefr4VKzi4/.va/:15266:0:99999:7:::

I tried grep -v ":$1$" /etc/shadow and grep -v ":\$1\$" /etc/shadow and grep -v :\$1\$ /etc/shadow to list the entries without MD5 encryption but no luck (none of them give expected output)

Please advise the correct way to get the user list without MD5 encrypted passwords. Thank you!


.

What platform are you on? Most pam-compatible systems allow the sysadmin to specify the encryption algorithm.

So before we go further, do you have a lot of users with root access? If not, then why have you not already specified the encryption algorithm? After that, you should have expired all passwords, thus forcing them to use your specified algorithm. Problem solved, IMO.

And if you have users with root access you cannot stop them from doing pretty much anything they please.

As you can see, I do not think what you are trying to do, as stated, is going to help much. So we need to know more.

As to your question: fgrep or grep -F tells grep not to use regex.

Code:

grep -F ':$1$' /etc/shadow

awk works, too:

Code:

awk -F':' 'index($2, "$1$")==1'  /etc/shadow

Code:

grep -Ev "^[^:]+:[$]1[$]" /etc/shadow

Thanks both.

That's what exactly I need at the moment - to list the users without MD5. This is on RHEL 6.7.

However the plan is to change default encryption algorithm to SHA512 and force users to change their password which I plan to do by below 2 commands:

Code:

authconfig --passalgo=sha512 --update

Code:

for u in $(awk -F: '{if ( $1 != "root" && $2 ~ /^!?[[:alnum:]\.\/\$]/ ) print $1}' /etc/shadow); do chage -d0 $u; done

Thanks again!

I think, it is already approx. 10 years at least, as MD5 is considered insecure.